Fabric-based anonymity management, systems and methods
Based on a hidden service address table stored in a memory, a virtual circuit related to a hidden service is mapped to a corresponding port-level channel based on the hidden service's address. Data associated with the hidden service is routed between the virtual circuit and the port-level channel. This enables binding of high level anonymity protocols to low level communication services of a network fabric and ensures that other nodes in the network fabric can leverage fabric-hosted hidden services without requiring updates to an existing anonymity protocol.
1. An apparatus comprising:
a plurality of network ports, each of the plurality of the network ports capable of supporting a corresponding port-level channel; and
a router configured to at least:
route network traffic among the plurality of network ports according to a port-forwarding table,
map a virtual circuit related to a hidden service to a first port-level channel of a first port of the plurality of network ports according to a hidden service address in a hidden service address table, and
route data associated with the hidden service between the virtual circuit and the first port-level channel.
2. The apparatus of claim 1 , wherein the first port-level channel comprises an encrypted channel.
3. The apparatus of claim 2 , wherein the encrypted channel comprises a port-to-port encrypted session.
4. The apparatus of claim 1 , wherein the hidden service address comprises a network address and public key pair.
5. The apparatus of claim 1 , wherein the plurality of network ports comprises at least one optic fiber port.
6. The apparatus of claim 5 , wherein the virtual circuit maps to the first port-level channel at a specified wavelength on the at least one optic fiber port.
7. The apparatus of claim 5 , wherein the at least one optic fiber port comprises at least one of a HiGIG port, a HiGIG+ port, or a HiGIG2 port.
8. The apparatus of claim 1 , wherein the plurality of network ports comprises at least one Ethernet port.
9. The apparatus of claim 8 , wherein the virtual circuit maps to a second port-level channel at a MAC address of the at least one Ethernet port.
10. The apparatus of claim 9 , wherein the at least one Ethernet port comprises at least one of a 10 Mbps port, a 100 Mbps port, a 1000 Mbps port, or a 10 Gbps port.
11. The apparatus of claim 1 , further comprising a hidden service manager module configured to at least update the hidden service address table.
12. The apparatus of claim 11 , wherein the hidden service manager module is configured to at least update the hidden service address table upon a migration of the hidden service.
13. The apparatus of claim 11 , wherein the hidden service manager module is configured to at least host the hidden service.
14. The apparatus of claim 13 , wherein the hidden service is hosted on the first port-level channel.
15. The apparatus of claim 1 , wherein the first port-level channel comprises a distributed network interface of the hidden service.
16. The apparatus of claim 1 , wherein the hidden service address table comprises a distributed hash table.
17. The apparatus of claim 1 , further comprising a cryptographic module configured to at least secure the data between the virtual circuit and the first port-level channel.
18. The apparatus of claim 17 , wherein the cryptographic module is configured to perform at least one of decrypting data flowing from the first port-level channel to the virtual circuit or encrypting data flowing from the virtual circuit to the first port-level channel.
19. The apparatus of claim 1 , wherein the router is further configured to at least package the data into fixed size cells before routing the data over the first port-level channel.
20. The apparatus of claim 1 , wherein the virtual circuit comprises an onion routing path.
21. The apparatus of claim 1 , wherein the virtual circuit comprises a telescoping circuit.
22. The apparatus of claim 1 comprising, or comprised in, a network fabric device.
23. The apparatus of claim 1 further comprising a memory including a hidden service address table capable of storing virtual circuit endpoints that include the hidden service address and the first port-level channel, the memory further including the port-forwarding table.